MICROSOFT says a China-aligned state actor, tracked as Storm-0940, used the ARTEX agentic AI framework in a campaign targeting hundreds of organisations worldwide from September 2026. The actor gained privileged access to cloud environments, sometimes in under three hours. After compromising identities in ConnectWise’s multi-tenant Microsoft 365 application, it targeted the company’s customers, using ARTEX to speed up reconnaissance, password spraying and abuse of OAuth applications.
Microsoft reported more than 2,250 tenant sign-in attempts, at a rate of 2,900 per minute, and found evidence in multiple customer environments of reconnaissance and changes to application credentials, identities, groups and privileged roles. Microsoft described the activity as an abuse of trust between ConnectWise applications and customer tenants.
ConnectWise said it detected suspicious activity on 15 October and unauthorised access to application identities in its Cloud Backup environment on 17 October. It took Cloud Backup, SaaS Security and Cloud Management offline while investigating. In an update on 22 October, the company said phased restoration of Cloud Backup had begun and was expected to take several days; customers were told to keep affected connections disabled until they receive service-specific instructions.
ConnectWise said existing backup archives remained encrypted, isolated and preserved, with no indication they were compromised, and that it had no evidence other products or services were affected. It advised customers to check their Microsoft 365 tenants for unauthorised changes or persistent access.
ARTEX is a multi-agent large language model framework that automates offensive security tasks from reconnaissance through data exfiltration. Microsoft says its agents compile discovered assets and vulnerabilities into a graph. The article also notes a separate October 2026 report that a China-based actor used ARTEX against South Korean financial organisations.